11. Standards and references
Vord's external surface conforms to published standards rather than innovating (ADR-0003, ADR-0025): a relying party verifies a Vord token, a service provider federates over SAML, and an IdP provisions over SCIM using stock implementations. This is the catalogue of every external standard the design adopts, what Vord uses it for, and the ADR that adopts it.
Vord's own normative artifacts — the token and credential format and its
conformance vectors — are not listed here; they live in specs/ and are
versioned independently (ADR-0003).
Where a standard is still an IETF Internet-Draft, the table says so; the
Datatracker link resolves to the latest revision, and the revision Vord implements is
pinned in specs/ when built.
Token and credential formats
| Standard | Role in Vord | Adopted in |
|---|---|---|
| JWT — RFC 7519 | the external ID / access token container | 0003, 0014 |
| JWS — RFC 7515 | the signature structure over tokens | 0003 |
| JWA — RFC 7518 | algorithm identifiers (ES256 interop suite) | 0003 |
| JWK / JWKS — RFC 7517 | public-key publication the edge reads to verify | 0010, 0021 |
| SD-JWT — RFC 9901 | selective-disclosure base for the Troth credential | 0003 |
| SD-JWT VC — draft-ietf-oauth-sd-jwt-vc (draft) | the Troth verifiable-credential profile | 0003 |
| Token Status List — draft-ietf-oauth-status-list (draft) | the signed, edge-cached revocation projection | 0005 |
| Biscuit | reserved holder-attenuable capability token | 0003 |
| JWT BCP — RFC 8725 | JWT security best current practices | 0003 |
Cryptography
| Standard | Role in Vord | Adopted in |
|---|---|---|
| EdDSA / Ed25519 — RFC 8032 | the primary token signature suite | 0003 |
| CFRG curves in JOSE — RFC 8037 | EdDSA bindings for JOSE/JWT | 0003 |
| ECDSA P-256 / ES256 — RFC 7518 §3 | the interop signature suite | 0003 |
| Argon2id — RFC 9106 | password hashing in the login ceremony | 0015 |
| ML-DSA — FIPS 204 | the general-purpose post-quantum signature target (named, not yet pinned) | 0042 |
| SLH-DSA — FIPS 205 | the conservative hash-based post-quantum signature alternative | 0042 |
| ML-KEM — FIPS 203 | post-quantum key-establishment for the confidentiality / HNDL surface | 0042 |
OAuth 2.0 and OpenID Connect
| Standard | Role in Vord | Adopted in |
|---|---|---|
| OAuth 2.0 — RFC 6749 | the authorization framework | 0014 |
| Bearer token usage — RFC 6750 | token presentation to relying parties | 0014 |
| PKCE — RFC 7636 | proof-of-possession on the code flow (mandatory) | 0014 |
| OpenID Connect Core 1.0 | the identity layer / ID tokens | 0003, 0014 |
| OIDC Discovery 1.0 | /.well-known/openid-configuration |
0014 |
| OIDC RP-Initiated Logout | front-channel logout, into the session model | 0014, 0016 |
| OIDC Back-Channel Logout | logout notification to relying parties (complete single-logout) | 0016 |
| OIDC Front-Channel Logout | browser-based logout notification where no back channel exists | 0016 |
| Token Exchange — RFC 8693 | the SAML / upstream-IdP → OIDC bridge | 0014, 0017, 0019 |
| AMR values — RFC 8176 | amr/acr authentication-context claims |
0015, 0020 |
| Device Authorization Grant — RFC 8628 | reserved (device / CLI surface) | 0014 |
| PAR — RFC 9126 | reserved (FAPI prerequisite) | 0014, 0025 |
| DPoP — RFC 9449 | reserved (sender-constrained tokens) | 0014, 0025 |
| Mutual-TLS bound tokens — RFC 8705 | reserved (FAPI sender-constraining) | 0025 |
| Dynamic Client Registration — RFC 7591 | self-serve client onboarding (reserved); the client model itself is 0038 | 0021, 0038 |
| OAuth 2.0 Security BCP — RFC 9700 | the threat model + mitigations for the OAuth surface (mix-up, redirect, code injection) | 0014, 0027 |
Authentication factors
| Standard | Role in Vord | Adopted in |
|---|---|---|
| WebAuthn Level 2 — W3C Recommendation | passkeys / FIDO2 (phishing-resistant MFA) | 0020 |
| TOTP — RFC 6238 | time-based one-time-password factor | 0015, 0020 |
| HOTP — RFC 4226 | HMAC OTP (the basis of TOTP) | 0015 |
Enterprise SSO and provisioning
| Standard | Role in Vord | Adopted in |
|---|---|---|
| SAML 2.0 — OASIS Standard | enterprise SSO as an identity provider (roadmap) | 0017 |
| SCIM 2.0 core schema — RFC 7643 | the provisioning data model (roadmap) | 0018 |
| SCIM 2.0 protocol — RFC 7644 | the provisioning protocol (roadmap) | 0018 |
Authorization
| Standard | Role in Vord | Adopted in |
|---|---|---|
| Zanzibar — Google, USENIX ATC '19 | the ReBAC reference architecture and the consistency "zookie" | 0006, 0004 |
| Cedar | the embedded ABAC/RBAC policy engine (dev profile) | 0006 |
| SpiceDB | a production Zanzibar engine (candidate) | 0006, 0008 |
| OpenFGA | a production Zanzibar engine (candidate) | 0006, 0008 |
Conformance and high-security profiles
| Standard | Role in Vord | Adopted in |
|---|---|---|
| OpenID Connect Certification | the v1-era OpenID Provider conformance target | 0025 |
| FAPI 2.0 Security Profile — Final | reserved high-security (financial-grade) target | 0025 |
Governance and licensing
| Standard | Role in Vord | Adopted in |
|---|---|---|
| Apache License 2.0 | the outbound license | 0008 |
| Developer Certificate of Origin | per-commit contribution provenance | 0008 |
| Contributor Covenant 3.0 | the code of conduct | governance |
Security frameworks and verification
The methodology Vord reviews and threat-models against (ADR-0027, ADR-0028).
| Framework | Role in Vord | Adopted in |
|---|---|---|
| STRIDE | the threat-classification taxonomy (the STRIDE-per-boundary pass) | §12.4, 0027 |
| LINDDUN | the privacy-threat taxonomy (the privacy pass parallel to STRIDE) | 0041, 0027 |
| OWASP ASVS v5.0 | the verification rubric the security review checks against; abuse-case tests derive from it | 0027, 0028 |
| OWASP API Security Top 10 | the API-risk baseline for the OIDC / OAuth / SCIM / admin surfaces | 0027 |
| OWASP Threat Dragon | threat-model-as-code (Apache-2.0, OWASP-governed) — the model run in CI, reserved until code begins | 0027, 0008 |
| OWASP Cheat Sheet Series | practical control guidance (JWT / OAuth / SAML security) | 0027 |